mjhjmtu

I was studying the Wi-Fi security section for a pentesting certification the other day and there is an extensive part about cracking WEP. Is going in-depth on WEP cracking worth it anymore?

According to this statistic: https://wigle.net/stats# about 7% of Wi-Fi networks still use WEP for encryption today. It's not a lot, but at the same time it is a lot considering that WEP was deprecated in 2004.

Thoughts?

Unfortunately, WEP is still present in the world. There are legacy systems and devices in certain environments that can only do WEP, plus a number of networks that have no one interested and/or knowledgeable enough to update. Like many advances in technology, phasing out the older technology takes time. Look at IPv4 vs. IPv6 after 20ish years and tell me which is still predominant.

That being said, WEP is no longer viable in modern 802.11 networking. Not only is WEP not viable in modern 802.11 networking, neither is TKIP (was initially used as part of WPA certification). Since the release of the 802.11n amendment to the standard, the use of either requires that devices disable the use of HT or VHT data rates.

In other words, the use of WEP or TKIP causes a modern 802.11 network (i.e. 802.11n or newer) to function little better than an 802.11a/g network. While you do pick up some of the advantages of newer standards, the performance (which is the typical driving force for people to upgrade) is negated.

But all that aside, I have to point out that Wigle's stats are a bit "flawed" unless you actually understand what it is you are really viewing. Wigle is a large, user collected database of information. However, as far as I know, they do not age out old data for a number of reasons (for instance, just because someone hasn't recorded updated information on a network doesn't mean it isn't still present).

So what you have is a large number of networks present in their data that are not present in the real world. If you check many of the WEP entries, they will not have been updated in 5 or more years. Many of these are likely gone or replaced.

In the graph on the Wigle statistics page, the shown decline of WEP is largely due to new networks being added to the database that are not using WEP, rather than WEP networks being removed from the database. Pulling from the Wigle.net API, these stats may present a more accurate picture of the decline of WEP:

All Entries
-------------------
464,429,878 (Total)
 31,800,699 (WEP)
---WEP: 6.85%---

Updated since 2014
-------------------
343,970,477 (Total)
 8,550,789 (WEP)
---WEP: 2.49%---

Updated since 2016
-------------------
233,996,263 (Total)
 4,374,629 (WEP)
---WEP: 1.87%---

Updated since 2017
-------------------
158,548,717 (Total)
 2,707,548 (WEP)
---WEP: 1.71%---

As you can see, while WEP is still certainly present, the real world statistics of WEP being in the wild is much lower than the 6-7% number to which you were referring.

I have been studying WEP as a project in school (great examples of what should not do in crypto !).
When I took a look at usage stats, it was 8% (if you think about the 45% back in 2010). Even if it seems low, I think it took way to long and I still see some Wi-Fi set to WEP (in France).

In my opinion, it shouldn't be an option anymore, even for backward compatibility. I took way to long to deprecated it, given the fact the first automated attack was published in 2001.

WEP has been broken for a long time, but upgrading from WEP to WPA2 implies delivering new hardware for each Access Point, client device, repeaters, etc. It's a huge investment to do at once, so compatible devices are available (Actually they're still being made, every smart phone I know is capable to connect to WEP networks), and that's a cycle: There is no need to migrate from WEP to WPA2 right now cause compatible devices exist and there is no need to change all the devices cause compatibility is still there.

Given that, while the impact of exploiting WEP may be high and the attack is pretty simple and known, the likelihood of the attack is not as much as it seems. An attacker needs to be physically in the same place as the vulnerable AP and close enough to actually be able to send packets in a reliable way. And sadly this kind of risk tends to be ignored